Apps

Get an upload link (from an app)

For an app's own server code only: fetch(env.HYPAMOON_API + "/app-files", { method: "POST", ... }) without an Authorization header; Hypamoon adds the app's key, and any other key gets 403. Returns a path on the site's own address where the browser PUTs the exact bytes, once, within 15 minutes. The type is checked against the bytes, PDFs and text go through the abuse check, and the size counts toward the files in the plan. Forward the x-hypamoon-user and x-hypamoon-user-sig headers of the request to make the file the signed-in user's own: it is stored in their own folder, only they (and users with the admin role, the first of auth.roles) can download it, and it goes with them on export or deletion. Only forward the headers; never check their signature in the code.

post/app-files

Request

  • Base URL: https://api.hypamoon.com/api/v1
  • URL: https://api.hypamoon.com/api/v1/app-files
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL https://app.hypamoon.com/oauth/authorize, token URL https://api.hypamoon.com/oauth/token, scopes: data:write)

Request body

namestring required

The file name, like receipt.pdf.

content_type'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp' | 'application/pdf' | 'video/mp4' | 'video/webm' | 'audio/mpeg' | 'audio/mp4' | 'audio/webm' | 'image/heic' | 'image/heif' | 'video/quicktime' | 'text/plain' | 'text/csv' | 'application/json' required

The type: images (png, jpeg, gif, webp, heic, heif), pdf, video (mp4, webm, mov), audio (mp3, m4a, webm), plain text, csv or json. The bytes are checked against it.

sizeinteger required

The exact size in bytes (File.size in the browser).

user_idstring uuid

Leave it out. To make the file the signed-in person's own, forward the x-hypamoon-user and x-hypamoon-user-sig headers of the request; if you send user_id, it must be that same person.

Response

The upload link.

idstring uuid required
upload_urlstring required

PUT the bytes here from the browser, on the site's own address. Works once.

method'PUT' required
expires_atstring required

Changes

No recorded changes to this operation across all 1 revision of this API.